Detection rules › Sublime MQL
Callback phishing via Google Group abuse
A fraudulent invoice/receipt found in the body of the message, delivered via a Google Group mailing list.
Threat classification
Sublime's own taxonomy (not MITRE ATT&CK).
| Category | Values |
|---|---|
| Attack types | Callback Phishing |
| Tactics and techniques | Free email provider, Impersonation: Brand, Social engineering |
Event coverage
Rule body MQL
type.inbound
and length(attachments) < 5
and sender.email.domain.domain == "googlegroups.com"
and (
any(attachments,
(.file_type in $file_types_images or .file_type == "pdf")
and (
any(file.explode(.),
// exclude images taken with mobile cameras and screenshots from android
not any(.scan.exiftool.fields,
(
.key == "Model"
or (
.key == "Software"
and strings.starts_with(.value, "Android")
)
)
// exclude images taken with mobile cameras and screenshots from Apple
and (
.key == "DeviceManufacturer"
and .value == "Apple Computer Inc."
)
)
and any(ml.nlu_classifier(.scan.ocr.raw).intents,
.name == "callback_scam" and .confidence == "high"
)
)
)
)
or any(ml.nlu_classifier(body.current_thread.text).intents,
.name in ("callback_scam") and .confidence == "high"
)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
(
sender.email.domain.root_domain in $high_trust_sender_root_domains
and not headers.auth_summary.dmarc.pass
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
Detection logic
Scope: inbound message.
A fraudulent invoice/receipt found in the body of the message, delivered via a Google Group mailing list.
- inbound message
- length(attachments) < 5
- sender.email.domain.domain is 'googlegroups.com'
any of:
any of
attachmentswhere all hold:any of:
- .file_type in $file_types_images
- .file_type is 'pdf'
any of
file.explode(.)where all hold:not:
any of
.scan.exiftool.fieldswhere all hold:any of:
- .key is 'Model'
all of:
- .key is 'Software'
- .value starts with 'Android'
all of:
- .key is 'DeviceManufacturer'
- .value is 'Apple Computer Inc.'
any of
ml.nlu_classifier(.scan.ocr.raw).intentswhere all hold:- .name is 'callback_scam'
- .confidence is 'high'
any of
ml.nlu_classifier(body.current_thread.text).intentswhere all hold:- .name in ('callback_scam')
- .confidence is 'high'
any of:
all of:
- sender.email.domain.root_domain in $high_trust_sender_root_domains
not:
- headers.auth_summary.dmarc.pass
- sender.email.domain.root_domain not in $high_trust_sender_root_domains
Inspects: attachments[].file_type, body.current_thread.text, headers.auth_summary.dmarc.pass, sender.email.domain.domain, sender.email.domain.root_domain, type.inbound. Sensors: file.explode, ml.nlu_classifier, strings.starts_with. Reference lists: $file_types_images, $high_trust_sender_root_domains.
Indicators matched (11)
| Field | Match | Value |
|---|---|---|
sender.email.domain.domain | equals | googlegroups.com |
attachments[].file_type | equals | pdf |
file.explode(attachments[])[].scan.exiftool.fields[].key | equals | Model |
file.explode(attachments[])[].scan.exiftool.fields[].key | equals | Software |
strings.starts_with | prefix | Android |
file.explode(attachments[])[].scan.exiftool.fields[].key | equals | DeviceManufacturer |
file.explode(attachments[])[].scan.exiftool.fields[].value | equals | Apple Computer Inc. |
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).intents[].name | equals | callback_scam |
ml.nlu_classifier(file.explode(attachments[])[].scan.ocr.raw).intents[].confidence | equals | high |
ml.nlu_classifier(body.current_thread.text).intents[].name | member | callback_scam |
ml.nlu_classifier(body.current_thread.text).intents[].confidence | equals | high |